secrex-exchange[.]com

Analysis indicates that the domain secrex-exchange.com is currently active and serving HTTP responses with status code 200. The domain is hosted on Cloudflare infrastructure, as evidenced by the authoritative name servers milan.ns.cloudflare.com and samara.ns.cloudflare.com. Registration records show the domain was registered through Sollutium EU sp. z o.o., a registrar operating in the European Union. VirusTotal scans have resulted in 13 of 91 security vendors flagging the domain, reflecting a detection rate consistent with its classification as a generic phishing site. The domain is listed on the PhishDestroy blocklist and appears on one additional security blocklist, confirming that defensive feeds are already distributing indicators of compromise.

The observed threat vector is credential harvesting, where attackers likely lure victims to submit login credentials. No further metadata such as page title, SSL fingerprint, or specific brand targeting is available in the current intelligence set, limiting precise attribution of the impersonated service. Nonetheless, the combination of active HTTP service, Cloudflare DNS, registrar information, and multiple vendor detections provides sufficient evidence for security teams to treat the domain as malicious.

Defenders should add secrex-exchange.com to network and email filtering rules, update DNS blocklists with the observed name‑server entries, and monitor for outbound connections to the associated IP ranges. Ongoing re‑scanning on VirusTotal or comparable platforms is recommended to capture any changes in detection status. Organizations are also encouraged to educate users about unsolicited credential requests referencing this domain, reinforcing verification before entering sensitive information.